CVE-2026-103663

Ollama model-layer paths can write outside the model store

Ollama / CERT Polska · Ollama

First documented disclosure · Review checkpoint

Summary

A remote caller could use malformed model-layer paths to write files beyond the model store.

Severity and exploitation evidence

Critical · 9.4/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Layer digest handling did not sufficiently constrain the resulting filesystem path.

Conditions required

Unauthenticated API access; root execution additionally requires write access to the Ollama library directory and a later server restart.

Potential impact

Arbitrary file writes; eligible container deployments could execute the planted code as root after restart.

Affected versions and configurations

0.34.2 through versions before 0.35.0.

Fix and mitigation status

0.35.0.

Practical next steps

Upgrade, run without unnecessary filesystem privileges, and inspect affected library directories before restarting exposed instances.

Operating lesson

Inference containers should not be able to rewrite their own executable libraries.

Evidence and limits

CERT Polska supplies scenario-specific scores: 6.9 without library-directory write access and 9.4 with that access. The higher score applies to the stated execution scenario, not every installation.

Sources